Overview

overview

10

Static

static

5

BL.exe

windows7-x64

10

BL.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BL.exe
  • Size 1.2MB
  • Sample240612-c3eftayhke
  • SHA256 f0a931ba453d846bac36ab75d1e79847170cd8f562ccb117e92133434d301abf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 34 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 34 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 34 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 34 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 34 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 34 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BL.exe
    "C:\Users\Admin\AppData\Local\Temp\BL.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\BL.exe"
      2⤵
        PID:4972
      • C:\Users\Admin\AppData\Local\Temp\BL.exe
        "C:\Users\Admin\AppData\Local\Temp\BL.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:752
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\BL.exe"
          3⤵
            PID:3308
          • C:\Users\Admin\AppData\Local\Temp\BL.exe
            "C:\Users\Admin\AppData\Local\Temp\BL.exe"
            3⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2660
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\BL.exe"
              4⤵
                PID:3988
              • C:\Users\Admin\AppData\Local\Temp\BL.exe
                "C:\Users\Admin\AppData\Local\Temp\BL.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2376
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Users\Admin\AppData\Local\Temp\BL.exe"
                  5⤵
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3016
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 704
                  5⤵
                  • Program crash
                  PID:5104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2376 -ip 2376
          1⤵
            PID:3820

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                aut4AF3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\aut4AF3.tmp
                • Size 262KB
                • SHA256 d86d071e35fcedc86965dcb306d2bff1971d34f8212122f7bc7363e8d95bfdd8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                aut5015.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\aut5015.tmp
                • Size 9KB
                • SHA256 0457bc34e063166efb2345d8ce776359a7f9f1d04b7e8cb436c91ef0268e7305
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                uncolorable
                • Path C:\Users\Admin\AppData\Local\Temp\uncolorable
                • Size 262KB
                • SHA256 2dba97f793255e5e456c170a9b0fd8a0ebdf9d0eb7732b8ee47b2dd378666113
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                unjust
                • Path C:\Users\Admin\AppData\Local\Temp\unjust
                • Size 28KB
                • SHA256 6c2701dbdf58b35fe5149863a42061cf8a1b09ed7f0c3202efcbd1c97f2568f7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/3016-105-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-95-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-56-0x0000000000400000-0x0000000000446000-memory.dmp
                Download

                memory/3016-57-0x0000000005940000-0x0000000005994000-memory.dmp
                Download

                memory/3016-58-0x00000000060C0000-0x0000000006664000-memory.dmp
                Download

                memory/3016-59-0x00000000059F0000-0x0000000005A44000-memory.dmp
                Download

                memory/3016-60-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-69-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-121-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-119-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-117-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-115-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-113-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-1094-0x0000000005C10000-0x0000000005C76000-memory.dmp
                Download

                memory/3016-111-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-109-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-107-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-1098-0x0000000006A80000-0x0000000006A8A000-memory.dmp
                Download

                memory/3016-103-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-101-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-97-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-55-0x0000000000400000-0x0000000000446000-memory.dmp
                Download

                memory/3016-93-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-91-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-89-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-87-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-85-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-83-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-81-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-79-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-77-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-75-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-71-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-67-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-66-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-63-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-62-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-99-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-73-0x00000000059F0000-0x0000000005A3D000-memory.dmp
                Download

                memory/3016-1096-0x0000000006A20000-0x0000000006A70000-memory.dmp
                Download

                memory/3016-1097-0x0000000006B10000-0x0000000006BA2000-memory.dmp
                Download

                memory/4580-12-0x0000000003550000-0x0000000003554000-memory.dmp
                Download